FDIC Rolls Out New IT Examination Work Program

Webinar: ID# 1002951

Date: Recorded

About This Course:

First, the Regulators rolled out the Cyber Assessment Tool (CAT), then one year later the FDIC released its new Information Technology Risk Examination Program - or InTREx for short. The examination work program incorporates many of the work steps and review areas from the FFIEC IT Examination Handbook, while incorporating a focus on cyber security and drawing from the CAT declarative statements.

Along with the new work program is a new Information Technology Profile to replace the former IT Officer’ Questionnaire, and a resurrection of the original Uniform Rating System for Information Technology (URSIT), which includes a rating for each of the four examination components and an overall composite rating.

Not only is the FDIC changing things up, but word on the street is the Federal Reserve and Conference of State Banking Supervisors (CSBS) will follow suit.

Covered Topics:

Overview of Examination Process

Technology Profile

Component Control framework – Audit, Management, Development and Acquisition, and Support and Delivery

Susan Orr is a leading financial services expert with vast regulatory, risk management, and security best practice knowledge and expertise.

As an auditor and consultant, Susan is dedicated to assisting financial institutions in implementing appropriate policies and controls to protect confidential information and comply with regulatory mandates and best practices. Her expertise as an auditor and former examiner provides her the knowledge and expertise to conduct comprehensive IT general control and data security reviews and assist de novo institutions in the vendor selection process, preparing policies and procedures, and instituting controls. She also consults for numerous security providers and vendors helping them align products and services to meet institution regulatory mandates. Susan is a Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM), Certified in Risk and Information Systems Control (CRISC), and Certified Risk Professional (CRP).